Privacy notice
Draft for legal review. A working draft written before launch, not yet in force. The controller's legal details, retention periods and lawful bases will be confirmed at legal review.
Who is responsible
Yallo Group, for Mockplan. Contact for any privacy question or request: support@yallo.co.
What we collect
| About | What | Why |
|---|---|---|
| Parent | Email address, sign-in times, consent records, passes bought | To run your account, sign you in and record what you agreed to |
| Child | Nickname, year group, exam date, extra-time setting, practice answers and time per question | To run practice, mark it, and show you progress and a plan |
| Visitors to public pages | Cookieless page-view counts | To see which public pages are read; no cookies, no profile of you |
Children's data
- Children never give us an email address, surname, photo or contact details.
- A parent or legal guardian gives consent before any child profile is created, and can withdraw it.
- There is no advertising, no third-party tracking and no analytics on children's pages.
- We do not compare a child with other children or share a child's results with anyone, schools included.
- A parent can ask us to see, correct or delete a child's data at any time.
Cookies
Only cookies needed for the service: one that keeps you signed in, and one that records which child is practising on this device. No advertising or analytics cookies.
Who processes data for us
- Vercel: hosting and cookieless page-view counts for public pages.
- Neon: the database.
- Resend: sending sign-in emails.
- Stripe: card payments, once they open.
Locations of processing and transfer safeguards to be listed at legal review.
How long we keep it
Proposed: while the account is open, then deleted within 12 months of the child's last exam date unless you ask us to delete it sooner. To be confirmed.
Your rights in the UAE (Personal Data Protection Law)
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you can ask for access to, correction of and deletion of personal data, restrict or object to processing, and withdraw consent. Details to be confirmed at legal review, including any free zone rules that apply.
Your rights in the UK (UK GDPR)
When the UK market opens: rights of access, rectification, erasure, restriction, portability and objection under the UK GDPR and the Data Protection Act 2018, with the right to complain to the Information Commissioner's Office. We will review the service against the Age Appropriate Design Code before UK launch.
Changes
We will tell account holders by email before any material change to this notice.